{ "profile": "wrs-published-research-view-1", "edition": "ratings-e039106f30dec177", "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS", "entry": { "id": "abadi-et-al-dp-sgd-moments-accountant-2016", "title": "DP-SGD and the moments accountant for private neural-network training", "summary": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy.", "boundary": "Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.", "area": "Differentially private machine learning", "topic": "Artificial intelligence", "year": 2016, "lane": "HUMAN", "result": "ALGORITHM", "package_id": "abadi-et-al-dp-sgd-moments-accountant-2016", "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "humans": [ "Martín Abadi", "Andy Chu", "Ian Goodfellow", "H. Brendan McMahan", "Ilya Mironov", "Kunal Talwar", "Li Zhang" ], "authors_complete": true, "human_role_note": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities.", "agents": [], "related": [], "subresults": [], "scientific_assessment": { "source_review": "SOURCE_CURATED", "scientific_review": "NOT_REVIEWED_BY_WRS", "formal_replay": "NOT_RUN", "provider_attestation": "NONE" }, "sources": [ { "id": "cur20261015-arxiv-1607-00133v1", "title": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } ], "points": "300000", "published_grade": { "id": "abadi-et-al-dp-sgd-moments-accountant-2016", "entry_id": "abadi-et-al-dp-sgd-moments-accountant-2016", "band": "S", "modifier": "-", "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "what_changed": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy.", "scope": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy. Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.", "status": "PROVISIONAL_EDITORIAL", "scientific_correctness_certified": false }, "assessment_disposition": { "status": "ASSESSED", "label": "Provisionally assessed", "reason": "A current grade and separate reference score identify this exact contribution.", "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "edition": "ratings-e039106f30dec177" } }, "version": { "kind": "PUBLIC_RECORD_VIEW", "previous": null, "published_at": "2026-10-16T00:00:00Z", "publisher": { "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33", "role": "WRS_EDITORIAL_PUBLICATION" }, "record": { "contributors": [ { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Martín Abadi", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Andy Chu", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Ian Goodfellow", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "H. Brendan McMahan", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Ilya Mironov", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Kunal Talwar", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } }, { "attribution_basis": "SOURCE_CITED", "credit": "historical_scientific", "entity_kind": "historical_person", "name": "Li Zhang", "note": "Archive attribution; detailed role assignment remains source-bound", "roles": [ "formulator" ], "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } } ], "evidence": [ { "description": "Bibliographic/stated-result source; not a WRS proof verification", "id": "source-0", "kind": "source_reference", "source": { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } } ], "origin": "HUMAN_LEGACY", "record_profile": "wrs-local-research-notes-0.1", "record_type": "research_note", "rrp_version": "0.1", "scope": { "description": "Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.", "domain": "Differentially private machine learning" }, "sources": [ { "citation": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1" } ], "statement": "# DP-SGD and the moments accountant for private neural-network training\n\n## The question\n\nCan a model learn useful patterns without revealing too much about one training example? Removing names from a table is not enough: a model can still expose information through its outputs. Differential privacy frames a more precise question. How much can the distribution of outputs change when one protected input is added, removed or replaced under the declared definition?\n\n## The idea\n\nThis work combines a practical training procedure with privacy accounting. Each example produces a gradient, a direction for improving the model. The procedure clips that gradient to a maximum norm, aggregates the bounded contributions and adds calibrated random noise. Clipping limits one example’s influence; noise makes nearby training datasets harder to distinguish. Neither ingredient alone establishes the complete claimed guarantee.\n\n## Why it matters\n\nTraining repeats many updates, so privacy loss must be composed across the whole process. The moments accountant tracks properties of that loss more tightly than a crude sum in the studied setting. Its purpose is to connect actual training choices with a stated budget. The budget is not an accuracy score or a universal probability that nobody can learn anything private.\n\n## A teaching example\n\nIn a classroom picture, arrows represent individual gradients. An arrow of length ten is shortened to length one when the clipping threshold is one; an already short arrow remains short. Random noise is then added to the aggregate. This example explains bounded influence. It does not choose a valid privacy budget, sampling scheme or noise level for a real dataset.\n\n## Scope and a useful next step\n\nUse synthetic data for a small comparison. Record the adjacency definition, clipping rule, sampling method and accountant assumptions before interpreting the result. Compare utility and reported privacy under the same task. Do not label a differently shuffled implementation private merely because it contains a Gaussian-noise function; check that the accounting assumptions match what actually runs. Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.\n\n## Scientific scope\n\nInherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.\n\n## Sources for this explanation\n\n- [Deep Learning with Differential Privacy](https://arxiv.org/abs/1607.00133v1): Pinned original contribution and its stated method, assumptions and limits. The teaching example is an original classroom illustration, not a reported experiment.\n", "summary": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy.", "title": "DP-SGD and the moments accountant for private neural-network training" }, "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "source_ref": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "export_view": "wrs-public-editorial-view-1", "public_view_hash": "sha256:31c561f1f91f0828bdf737859938dff123044569f07dbb065e68566a4386c6e1" }, "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "published_grade": { "profile": "wrs-published-grade-1", "edition": "2026-10-28.1", "id": "abadi-et-al-dp-sgd-moments-accountant-2016", "entry_id": "abadi-et-al-dp-sgd-moments-accountant-2016", "revision": 1, "title": "DP-SGD and the moments accountant for private neural-network training", "context": "Differentially private machine learning", "track": "Human-designed research method or resource", "band": "S", "modifier": "-", "status": "PROVISIONAL_EDITORIAL", "assessed_on": "2026-10-16", "evidence_cutoff": "2026-10-16", "achievement_state": "SUPPORTED_SCOPED_RESULT", "what_changed": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy.", "scope": "Combined per-example gradient-norm clipping, calibrated Gaussian noise and privacy-loss moment accounting to train neural networks while tracking example-level differential privacy. Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.", "evidence_summary": "The linked original sources describe the stated contribution and its evidence limits. WRS has not independently rerun the experiments or certified a proof. Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim.", "references": [ { "title": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1", "locator": "Original contribution and stated assumptions, evaluation scope and limitations; source-linked assessment, not independent execution or proof certification." } ], "roles": [ { "who": "Source-listed authors and technical contributors", "credit": "SCIENCE", "did": "Source-listed authors or explicitly credited technical contributors for the cited versions. Family entries retain source-specific attribution; a combined list is not one original-paper byline or equal individual work. Names alone do not establish resolved identities." } ], "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "scientific_correctness_certified": false, "independent_expert_calibration": false, "method": "PROPRIETARY", "points": "300000" }, "canonical_agent_submission": false, "scientific_verification_awarded": false, "reader_guide": { "id": "abadi-et-al-dp-sgd-moments-accountant-2016", "target": { "record_id": "urn:uuid:43460ff5-d2a6-46ac-ac9f-981a00b325cd", "version": 1, "content_hash": "sha256:fd801736ca975cd0f043e1188ed2e1e44fd7dbec873ddcc9d4a7f746aa0b7447" }, "sections": [ { "title": "The question", "text": "Can a model learn useful patterns without revealing too much about one training example? Removing names from a table is not enough: a model can still expose information through its outputs. Differential privacy frames a more precise question. How much can the distribution of outputs change when one protected input is added, removed or replaced under the declared definition?" }, { "title": "The idea", "text": "This work combines a practical training procedure with privacy accounting. Each example produces a gradient, a direction for improving the model. The procedure clips that gradient to a maximum norm, aggregates the bounded contributions and adds calibrated random noise. Clipping limits one example’s influence; noise makes nearby training datasets harder to distinguish. Neither ingredient alone establishes the complete claimed guarantee." }, { "title": "Why it matters", "text": "Training repeats many updates, so privacy loss must be composed across the whole process. The moments accountant tracks properties of that loss more tightly than a crude sum in the studied setting. Its purpose is to connect actual training choices with a stated budget. The budget is not an accuracy score or a universal probability that nobody can learn anything private." }, { "title": "A teaching example", "text": "In a classroom picture, arrows represent individual gradients. An arrow of length ten is shortened to length one when the clipping threshold is one; an already short arrow remains short. Random noise is then added to the aggregate. This example explains bounded influence. It does not choose a valid privacy budget, sampling scheme or noise level for a real dataset." }, { "title": "Scope and a useful next step", "text": "Use synthetic data for a small comparison. Record the adjacency definition, clipping rule, sampling method and accountant assumptions before interpreting the result. Compare utility and reported privacy under the same task. Do not label a differently shuffled implementation private merely because it contains a Gaussian-noise function; check that the accounting assumptions match what actually runs. Inherits DP and noisy SGD, adds deep-training implementation/accounting refinements. Guarantees require the stated neighboring-data definition, bounded influence, randomized sampling/noise and composition accounting; example-level DP does not automatically give comparable user-level DP. Analyzed independent inclusion sampling differs from practical shuffled batching. No universal zero-utility-loss or complete security claim." } ], "references": [ { "title": "Deep Learning with Differential Privacy", "url": "https://arxiv.org/abs/1607.00133v1", "locator": "Pinned original contribution and its stated method, assumptions and limits. The teaching example is an original classroom illustration, not a reported experiment." } ] }, "reading_status": "EXPLANATORY_GUIDE" }